authn: do not overwrite AuthConfig.Auth when username and password are empty

[nileshpatil6]

Fixes #1864.

The bug

AuthConfig.MarshalJSON unconditionally recomputes the auth field:

func (a AuthConfig) MarshalJSON() ([]byte, error) {
	shadow := (authConfig)(a)
	shadow.Auth = encodeDockerConfigFieldAuth(shadow.Username, shadow.Password)
	return json.Marshal(shadow)
}

When neither Username nor Password is set there is nothing to derive it from, so auth becomes the encoding of ":", which is Og==.

AuthConfig{Auth: "dXNlcjpwYXNz"}    -> {"auth":"Og=="}
AuthConfig{RegistryToken: "bearer"} -> {"auth":"Og==","registrytoken":"bearer"}
AuthConfig{IdentityToken: "id"}     -> {"auth":"Og==","identitytoken":"id"}

The first case silently discards a valid credential: a config carrying only an already encoded Auth marshals to a useless one, and round-tripping it yields Auth: "Og==" with empty username and password. The second and third invent an auth field for configs that never had one.

This is the case reported in #1864, which was closed by the stale bot rather than resolved, with a follow-up noting it was still broken.

The change

Derive auth only when a username or password is present, otherwise leave whatever the caller set:

if shadow.Username != "" || shadow.Password != "" {
	shadow.Auth = encodeDockerConfigFieldAuth(shadow.Username, shadow.Password)
}

Configs carrying a username and password are unaffected, including the existing auth field replaced case where a stale Auth is deliberately overwritten.

Testing

Two cases added to the existing TestAuthConfigMarshalJSON table: an auth-only config, and a token-only config. Without the change both fail:

--- FAIL: TestAuthConfigMarshalJSON/auth_field_preserved_when_username_and_password_are_empty
--- FAIL: TestAuthConfigMarshalJSON/no_auth_field_is_invented_for_a_token_only_config

With it, TestAuthConfigMarshalJSON and TestAuthConfigUnmarshalJSON pass in full. TestPodmanConfig fails identically before and after on my machine because it picks up a REGISTRY_AUTH_FILE from the environment; it is unrelated to this change.

[Subserial]

Looks good, but can you remove the comments? They are redundant after the fix, and the comments on the test are useless when the test case already has a name.

[nileshpatil6]

Done, comments removed from both the fix and the test cases. Tests still pass.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.57%. Comparing base (3f4ff3c) to head (1766c32).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2420   +/-   ##
=======================================
  Coverage   57.57%   57.57%           
=======================================
  Files         166      166           
  Lines       11564    11565    +1     
=======================================
+ Hits         6658     6659    +1     
  Misses       4127     4127           
  Partials      779      779           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[nileshpatil6]

The failing e2e windows-latest job looks like a runner problem rather than something in this change.

The job pushed and tagged the image fine, then docker run aborted with:

failed to connect to the docker API at npipe:////./pipe/docker_engine; check if the path is correct and if the daemon is running: open //./pipe/docker_engine: The system cannot find the file specified.

so the Docker daemon was not up on that runner. The same job passed on other branches the same day (run 33007300693), and this change only affects JSON marshalling in pkg/authn, which the e2e script does not exercise.

I do not have permission to re-run the job. Could you kick it off when you get a chance?